AnyConnect double certificate authentication

[Michael Wollner]

Hallo,

can i implement a double certificate authentication on the Cisco ASA?

First Auth:

Machine certificate

Second Auth:

User certificate + RADIUS(OTP)

or:

First Auth:

User certificate + RADIUS(OTP)

Second Auth:

Machine certificate

mfg

Michael

[Marvin Rhoads]

You should be able to use a Dynamic Access Policy (DAP) setup to first check for the machine certificate. Then further configure the profile to check for user certificate plus the RADIUS OTP authentication.

I believe it will require Anyconnect Premium license to use DAP.